Update article to document ABP auto-generated API controllers and dynamic client proxies, including examples and where the behavior is implemented. Clarify that permission and feature checks are NOT automatic and must be applied explicitly with [Authorize] and [RequiresFeature] (notes about the related interceptor registrars included). Renumber sections, expand explanations for anti-forgery, event handling, UOW, outbox, virtual files, JSON settings, localization, and background jobs, and update the summary table to reflect the new/clarified items (Remote Services, Auto API Controllers, Dynamic Client Proxies, Permissions/Features changes).
@ -215,19 +215,101 @@ public class RemoteServiceAttribute : Attribute
---
## 13. Permission Checks Are Automatic
## 13. Auto API Controllers - Application Services Become REST APIs Automatically
**The Magic:** Every application service method is automatically protected. If you don't specify permissions, it still checks for login - no `[Authorize]` attribute needed!
**The Magic:** When you create an application service (class implementing an interface or inheriting from `ApplicationService`), ABP **automatically** creates REST API endpoints for it - no manual controller needed!
```csharp
// This interface is automatically exposed as /api/app/product
**The Magic:** On the client side, you don't need to write HTTP client code. ABP automatically generates **Dynamic JavaScript Proxies** and **Dynamic C# Proxies** that let you call your APIs as if they were local method calls!
**JavaScript (MVC/Razor Pages):**
```javascript
// Just call it like a local function!
var products = await productAppService.getList();
await productAppService.create({ name: "New Product" });
This is why you can inject application service interfaces directly in Blazor and call them like local methods!
---
## 14. Background Workers Auto-Registration
## 15. Permission Checks
By default, all application service methods and controllers are **public** and accessible. Add `[Authorize]` or `[AbpAuthorize]` to restrict access:
```csharp
[Authorize]
public async Task CreateAsync(CreateDto input) { }
[AbpAuthorize("MyApp.Permissions.CanCreate")]
public async Task CreateAsync(CreateDto input) { }
```
The `AuthorizationInterceptor` is added only when `[Authorize]` attribute is present on the class or method.
---
## 16. Background Workers Auto-Registration
**The Magic:** Background workers are enabled by default, and any class implementing `IBackgroundWorker` or `IQuartzBackgroundWorker` is auto-registered.
---
## 15. Entity ID Generation
## 17. Entity ID Generation
**The Magic:** ABP automatically detects the best ID generation strategy based on the entity type:
@ -239,7 +321,7 @@ public class RemoteServiceAttribute : Attribute
---
## 16. Anti-Forgery Token Magic
## 18. Anti-Forgery Token Magic
**The Magic:** ABP automatically handles CSRF protection with these hardcoded values:
Enis Necipoglu
8 months ago